Startcom certificate on the way to being untrusted, Android Central will be unreachable

[maxburn]

Both Apple and Mozilla have started the process of moving away from trusting WoSign/Startcom security certificates. There is quite a case built against trusting them here: https://wiki.mozilla.org/CA:WoSign_Issues

Please get Android Central (and the mobile apps) off of Startcom security certificates. I have distrusted them on my phone, which of course broke the app and I won't be turning that back on. I had to turn it back on in my computer to post this, but I won't be around much after this I guess.

P.S. As I type this I'm on a plain text non encrypted web page? What's up with that?

 

[James Falconer]

Thanks for reporting. Sending this to our tech team now.

 

[Marcus Adolfsson]

Thanks, we will keep an eye on the StartCom issue. We started using them recently for our EV certs.

We don't officially support HTTPS yet on our sites, so that is why you are seeing redirects between secure and non-secure pages. We plan on being fully HTTPS and HTTP/2 compliant later this month.

 

[Aquila]

@marcus that's awesome, thanks for the update!

 

[maxburn]

Plans are moving ahead to drop trust from wosign / startcom. Of all the places I visit android central seems to be the only one that doesn't work when I drop those certificates.

https://groups.google.com/forum/?nomobile=true#!topic/mozilla.dev.security.policy/BV5XyFJLnQM

https://threatpost.com/apple-to-block-wosign-intermediate-certificates/121044/

 

[Marcus Adolfsson]

We will have new certs installed by end of next week.

Thanks!

 

[Marcus Adolfsson]

New SSL Certs have been uploaded.

 

[maxburn]

Very nice, thanks.

 

[James Falconer]

Excellent.

@maxburn - thanks for the heads up.

@Marcus - thanks for the update!